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Dear Sir: 

I, Christopher Andrews, hereby declare and state as follows: 

1. I am a citizen of the United States and am more than twenty-one years of age. 



2. From February 5, 2007 to October 26, 2007, 1 have been employed by Kroll 
Ontrack Inc. ("KxoH") of Eden Prairie, Minnesota as a Computer Forensics Specialist. My duties 
have included conducting sound computer forensic analysis and maintaining strict media chain of 
custody using protocols and procedures in line with generally accepted computer forensic 
techniques and best practices, acquiring and preserving computer media in lab settings and onsitc 
data capture or seizure, performing data recovery, including both file and email recovery, on 
electronic media to be analyzed during the course of a computer forensic investigation, conduct 
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investigations involving analysis of electronic media including, but not limited to, fraud and 
financial crimes, theft of trade secrets, and destruction of evidence, and provide expert testimony as 
needed. 

3. The following paragraphs describe work that was completed by me, along 
with individuals working on my behalf and under my supervision and control. The work was 
completed in the United States. 

4. I received two Imation tape cartridges on September 29, 2007 which were 
shipped to Kroll with FedEx tracking number 860666470391. Upon information and belief, the 
Imation tape cartridges were shipped to Kroll by Mr. James D. Marks of Body Health Resources 
Corporation ("BHRC") of New York, New York. 

5. Each of the two Imation tape cartridges was received by Kroll Ontrack 
employee Michael Paal with post-it label providing identification. 

6. A first cartridge ("A01") was marked as "Tinman Backup 2", with the 
following dates provided and crossed out: "4/20/99," "5/3/99," "5/17/99," "6/1/99," "6/14/99," 
"6/28/99," "8/5/99 " "8/19/99," "9/3/99," "9/1 7/99," "9/30/99," "10/13/99," "1 1/1/99 " The 
following date was also provided and not crossed out: "1 1/17/99." I further labeled this tape as 
"AOL" 

7. The second cartridge ("A02") was marked "Tinman Off-Site Backup 6/30/99 
for Jamie " I further labeled this tape as "A02." 

8. I examined the tapes in the Kroll Computer Forensics lab in Eden Prairie, 
MN, using proprietary Kroll Ontrack software as well as EnCase (Guidance Software), to transfer 
and view the files which were recorded on A01 and A02. The procedures that I employed to transfer 
and view the files which were recorded on A01 and A02 can be summarized as follows: 

The data from both tapes (A01 and A02) was copied, bit-for-bit, to the Kroll 
Ontrack servers on October 5, 2007 by Kroll Ontrack employee Jae Hangge. 

{W:\O3O42\O00g956-us0\O1297954.DOC *03042000G956-USO* } 



Application No.: 09/556,945 3 Docket No.: 03042/000G956-US0 

Declaration Under 37 C.F.R. § 1.131 

The A01 media contains 150 unreadable files and the A02 media contains 
127 unreadable files. The copied data was protected as 'read-only' to avoid 
alteration of file system metadata where possible. The copied data was 
loaded into EnCase for further analysis. EnCase allows the user to view all 
data associated with a file including all file system and other metadata as well 
as deleted data and other unused data areas on a piece of media. In this 
matter the tapes contain only active (non-deleted) data. I created an Active 
File Listing report corresponding to each original tape, consisting of metadata 
such as the File Name, Description, Last Accessed Date, Created Date, Last 
Written Date, Size, and Path (location). 1 then performed a detailed keyword 
search for files named "Hcalth^survey.html" and "Health_surveyl.html". 

9. 1 found files labeled as follows on A01 : 
http://www.thebodv.com/survevs/h ealth survey.htmU 
http://www.thebody.com/surveys/health_surveyl.html. 

10. I found files labeled as follows on A02: 
http://www.thebodv.com/survevs/ health survey.html, 

http ://www. thebody.com/surveys/health_survey 1 .html 

11. I found all file system metadata on both tapes to be preserved and intact. 
Using the procedures summarized above in paragraph 8, 1 confirmed that the file system metadata 
states the date on which the files were created and, assuming the system clock was accurate on the 
machine that copied the original data to the tapes, confirmed that all four files identified in 
paragraphs 9 and 10 were created on May 24, 1999. 

12. Using the procedures summarized above in paragraph 8, 1 was able to view 
the contents of each of the four files identified in paragraphs 9 and 10. I confirmed that 
health_survey.html as it appears on each backup tape (A01, A02) contains the text, "Please remove 
my name as a volunteer," into which is coded a hypertext link to the following page: 
http://www.thebodv.com/survevs/health remove.ihtml . I also confirmed that health_surveyl.html as 
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it appears on each backup tape (A01, A02) contains the text, "This release shall be effective for a 
perpetual duration, but you may subsequently request that The Body no longer provide information 
to clinical researchers ," and into the underlined portion is coded a hypertext link to the following 
page: http://www.thebodyxom/survevs/health remove.ihtml 

13. Attached as Exhibits A and B are listings from the preserved metadata files 
on each backup tape A01 , A02, respectively, limited to the files identified in paragraphs 9 and 10. 
Attached as Exhibits C-F are true hard copy printouts of the HTML source code of each of the four 
files identified in paragraphs 9 and 10, viewed through Microsoft Internet Explorer 7. Attached as 
Exhibits G-J are true hardcopy printouts of the data viewed through Microsoft Internet Explorer 7 
contained in the four files identified in paragraphs 9 and 10. Each of Exhibits A - J are further 
marked to identify the backup tape which was the source of the exhibit. 

14. I further declare that all statements made herein are of my own knowledge 
and are true, and that all statements made on information and belief are believed to be true. I further 
declare that these statements are made with the knowledge that willful false statements and the like 
so made are punishable by fine or imprisonment or both, under Section 1001 of Title 18 of the 
United States code, and that such willful false statements may jeopardize the validity of the instant 
application or of any patent issued thereupon. 

Dated: 

Attachments: 

Exhibits A - B: Hardcopies of the metadata file listings from A01 and A02 as pertaining to 
the four files identified in paragraphs 9 and 10. 

Exhibits C-F: Hardcopies of the four files identified in paragraphs 9 and 10, opened in 
Microsoft Internet Explorer 7 using "view source". 

Exhibits G-J: Hardcopies of the four files identified in paragraphs 9 and 10, opened in 
Microsoft Internet Explorer 7. 
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